Security group has critical port open to the internet

Severity: Critical
Service: Security groups
Check ID: SG_CRITICAL_PORT_OPEN

What this check finds

This security group allows inbound access from 0.0.0.0/0 (the entire internet) on a critical port such as SSH (22), RDP (3389), or a database port. This means any IP address can attempt to connect. Exposed management and database ports are among the most commonly exploited attack vectors.

Passing looks like: No critical ports open to the internet.

How to fix it

Restrict the inbound rule to trusted IP ranges or a VPN/bastion CIDR.

AWS CLI

aws ec2 revoke-security-group-ingress --group-id SG_ID --protocol tcp --port PORT --cidr 0.0.0.0/0

Then add a replacement rule scoped to your trusted CIDR:

aws ec2 authorize-security-group-ingress --group-id SG_ID --protocol tcp --port PORT --cidr TRUSTED_CIDR

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

EC2 → Security Groups → select group → Inbound rules → Edit inbound rules.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Security group has critical port open to the internet
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	5.1.2 Ensure CIFS access is restricted to trusted networks to prevent unauthorized access 5.3 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports 5.4 Ensure no security groups allow ingress from ::/0 to remote server administration ports
PCI-DSS v4.0.1	1.2 Network security controls are configured and maintained
HIPAA Security Rule	164.312(e)(2) Network segmentation — protect ePHI network segments
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	AC-17 Remote Access SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.6.7 Remote working A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Security groups checks

All Security groups checks